CVE-2020-29043: Bigbluebutton

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.

Affected products

• Bigbluebutton Bigbluebutton: up to and including 2.2.29

Published 2020-11-26. Last modified 2026-06-17.